It seems now my desktop got infected. I immediately unplugged it from the Internet when I got the Virus pop up.
Spy Sheriff on task bar, TNS Search bar, blue screen with black box & red text background saying I'm infected and virus check found four infections.
I have ran Ewido, SpyBot and AdAware. I have removed the background and got back to my original desktop. It also appeared to remove Spy Sheriff from the task bar as well.
However the four virus infections in AVG scan say they are "embedded" and not removed. I am not sure when I can hook it back up to the Internet.
Here is my recent Hijack This log. I notice alot of entries to "japclan.com" This is a gaming clan in the game Battlefield 2. I am not sure how it got in my log, but a fellow player did send me a mod file sometime back. I wonder if that has anything to do with it.
I also see that smss.exe is here, along with Kernels32.exe (with s) in the log. These were in my log on my laptop earlier this week.
Here is the log, please let me know what to do next.
Logfile of HijackThis v1.99.1
Scan saved at 4:42:01 PM, on 8/19/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\OPHALDCS.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Ideazon\Zboard Software\Driver\Zboard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\WINDOWS\Seiko\slpcap.exe
C:\Program Files\InterMute\SpamSubtract\SpamSub.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\vxh8jkdq2.exe
C:\WINDOWS\System32\vxh8jkdq5.exe
C:\Program Files\Grisoft\AVG Free\avgwb.dat
C:\Documents and Settings\Owner\My Documents\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...lion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.h...lion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.h...lion&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.h...lion&pf=desktop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O1 - Hosts: 67.15.126.34 www.japsclan.com
O1 - Hosts: 67.15.126.34 www.japsclan.info
O1 - Hosts: 67.15.126.34 japsclan.info
O1 - Hosts: 67.15.126.34 japsclan.com
O1 - Hosts: 67.15.126.34 irc.japsclan.com
O1 - Hosts: 67.15.126.34 www.japsclan.us
O1 - Hosts: 67.15.126.34 japsclan.us
O1 - Hosts: 67.15.126.34 www.japsclan.org
O1 - Hosts: 67.15.126.34 japsclan.org
O1 - Hosts: 67.15.126.34 rxp-clan.us
O1 - Hosts: 67.15.126.34 www.rxp-clan.us
O1 - Hosts: 67.15.126.34 www.japsclan.com
O1 - Hosts: 67.15.126.34 www.japsclan.info
O1 - Hosts: 67.15.126.34 japsclan.info
O1 - Hosts: 67.15.126.34 japsclan.com
O1 - Hosts: 67.15.126.34 irc.japsclan.com
O1 - Hosts: 67.15.126.34 www.japsclan.us
O1 - Hosts: 67.15.126.34 japsclan.us
O1 - Hosts: 67.15.126.34 www.japsclan.org
O1 - Hosts: 67.15.126.34 japsclan.org
O1 - Hosts: 67.15.126.34 www.japsclan.com
O1 - Hosts: 67.15.126.34 www.japsclan.info
O1 - Hosts: 67.15.126.34 japsclan.info
O1 - Hosts: 67.15.126.34 japsclan.com
O1 - Hosts: 67.15.126.34 irc.japsclan.com
O1 - Hosts: 67.15.126.34 www.japsclan.us
O1 - Hosts: 67.15.126.34 japsclan.us
O1 - Hosts: 67.15.126.34 www.japsclan.org
O1 - Hosts: 67.15.126.34 japsclan.org
O1 - Hosts: 67.15.126.34 www.japsclan.com
O1 - Hosts: 67.15.126.34 www.japsclan.info
O1 - Hosts: 67.15.126.34 japsclan.info
O1 - Hosts: 67.15.126.34 japsclan.com
O1 - Hosts: 67.15.126.34 irc.japsclan.com
O1 - Hosts: 67.15.126.34 www.japsclan.us
O1 - Hosts: 67.15.126.34 japsclan.us
O1 - Hosts: 67.15.126.34 www.japsclan.org
O1 - Hosts: 67.15.126.34 japsclan.org
O1 - Hosts: 67.15.126.34 www.japsclan.com
O1 - Hosts: 67.15.126.34 www.japsclan.info
O1 - Hosts: 67.15.126.34 japsclan.info
O1 - Hosts: 67.15.126.34 japsclan.com
O1 - Hosts: 67.15.126.34 irc.japsclan.com
O1 - Hosts: 67.15.126.34 www.japsclan.us
O1 - Hosts: 67.15.126.34 japsclan.us
O1 - Hosts: 67.15.126.34 www.japsclan.org
O1 - Hosts: 67.15.126.34 japsclan.org
O1 - Hosts: 67.15.126.34 www.japsclan.com
O1 - Hosts: 67.15.126.34 www.japsclan.info
O1 - Hosts: 67.15.126.34 japsclan.info
O1 - Hosts: 67.15.126.34 japsclan.com
O1 - Hosts: 67.15.126.34 irc.japsclan.com
O1 - Hosts: 67.15.126.34 www.japsclan.us
O1 - Hosts: 67.15.126.34 japsclan.us
O1 - Hosts: 67.15.126.34 www.japsclan.org
O1 - Hosts: 67.15.126.34 japsclan.org
O1 - Hosts: 67.15.126.34 www.japsclan.com
O1 - Hosts: 67.15.126.34 www.japsclan.info
O1 - Hosts: 67.15.126.34 japsclan.info
O1 - Hosts: 67.15.126.34 japsclan.com
O1 - Hosts: 67.15.126.34 irc.japsclan.com
O1 - Hosts: 67.15.126.34 www.japsclan.us
O1 - Hosts: 67.15.126.34 japsclan.us
O1 - Hosts: 67.15.126.34 www.japsclan.org
O1 - Hosts: 67.15.126.34 japsclan.org
O1 - Hosts: 67.15.126.34 www.japsclan.com
O1 - Hosts: 67.15.126.34 www.japsclan.info
O1 - Hosts: 67.15.126.34 japsclan.info
O1 - Hosts: 67.15.126.34 japsclan.com
O1 - Hosts: 67.15.126.34 irc.japsclan.com
O1 - Hosts: 67.15.126.34 www.japsclan.us
O1 - Hosts: 67.15.126.34 japsclan.us
O1 - Hosts: 67.15.126.34 www.japsclan.org
O1 - Hosts: 67.15.126.34 japsclan.org
O1 - Hosts: 67.15.126.34 www.japsclan.com
O1 - Hosts: 67.15.126.34 www.japsclan.info
O1 - Hosts: 67.15.126.34 japsclan.info
O1 - Hosts: 67.15.126.34 japsclan.com
O1 - Hosts: 67.15.126.34 irc.japsclan.com
O1 - Hosts: 67.15.126.34 www.japsclan.us
O1 - Hosts: 67.15.126.34 japsclan.us
O1 - Hosts: 67.15.126.34 www.japsclan.org
O1 - Hosts: 67.15.126.34 japsclan.org127.0.0.1 www.trendmicro.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: My Web Search Bar BHO - {8EAB99C1-F9EC-4b64-A4BA-D9BCAE8779C2} - C:\Program Files\MyWebSearchWB\bar\1.bin\W6BAR.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [System] C:\WINDOWS\System32\kernels32.exe
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: SpamSubtract.lnk = C:\Program Files\InterMute\SpamSubtract\SpamSub.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: SmartCapture.lnk = C:\WINDOWS\Seiko\slpcap.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Add To HP Organize... - C:\PROGRA~1\HEWLET~1\HPORGA~1\bin\core.hp.main\SendTo.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop...p/PCPitStop.CAB
O16 - DPF: {1DF36010-E276-11D4-A7C0-00C04F0453DD} (Stamps.com Secure Postal Account Registration) - https://secure.stamp...16/sdcregie.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplane...DC_1_0_0_44.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z....iTunesSetup.exe
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...l_v1-0-3-24.cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - http://www.photodex.com/pxplay.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: Zboard - C:\WINDOWS\SYSTEM32\Winlognotif.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: DCS Loader (DCSLoader) - Oki Data Corporation - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\OPHALDCS.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SLPMONX - ProdEx Technologies - C:\WINDOWS\System32\slpservice.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
Edited by McPhenius, 19 August 2005 - 05:11 PM.
Sign In
Create Account
